CVE-2026-127086: Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.5.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Ryot user who knows a target collection ID can exploit the issue. No additional privileges or user interaction are required.
Are default deployments affected?
The issue is reachable through the createOrUpdateCollection GraphQL mutation and does not depend on a special configuration in the provided information. Ryot versions before 10.5.6 are affected.
What can an attacker do after exploiting it?
An attacker can reassign ownership of another user's collection, read its items, modify its metadata, and remove the original owner and collaborators.
How can I determine whether a collection may have been compromised?
Review collection ownership and collaborator membership for unexpected changes, especially collections whose owner was reassigned. Also inspect collection metadata and items for unauthorized modifications.